Omex Rent A Car

Privacy Policy

The English version is the source of record; in a dispute it governs.

Last Updated: February 10, 2026

Omex Rent A Car is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes how we collect, use, share, and protect information about you when you use our car rental services and website.

1. Information We Collect

We collect information that you provide directly to us, information we obtain automatically when you use our services, and information from other sources.

1.1 Information You Provide

1.2 Information Collected Automatically

2. Legal Basis for Processing (GDPR Article 13)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal information based on the following legal grounds:

2.1 Contract Performance (GDPR Article 6(1)(b))

We process the following data to fulfill our contractual obligations to you:

Data processed: Name, contact information, driver's license details, payment information, rental preferences, pickup/return dates and locations.

2.2 Legitimate Interests (GDPR Article 6(1)(f))

We process data for our legitimate business interests, which include:

Data processed: Device information, IP addresses, usage data, transaction records, communication records.

We have assessed that these interests are not overridden by your data protection rights.

2.3 Consent (GDPR Article 6(1)(a))

We process the following data only with your explicit consent:

Data processed: Email address, phone number, browsing behavior, location data, marketing preferences.

You may withdraw your consent at any time through your account settings, the unsubscribe link in marketing emails, or by contacting us directly.

2.4 Legal Obligations (GDPR Article 6(1)(c))

We process data to comply with legal requirements:

Data processed: Transaction records, identification documents, rental agreements, payment records.

3. How We Use Your Information

We use the information we collect for the following purposes:

4. Cookies and Tracking Technologies

We use various technologies to collect information about your use of our website.

4.1 Types of Cookies

Essential Cookies (Always Active)

Performance/Analytics Cookies (Require Consent)

Functional Cookies (Require Consent)

Advertising Cookies (Require Consent)

4.2 Cookie Consent Mechanism

For EEA, UK, and Swiss Users:

When you first visit our website, you will see a cookie consent banner that blocks all non-essential cookies until you make a choice. Here's how our consent system works:

  1. Initial Banner Display: Upon your first visit, we display a cookie consent banner that prevents non-essential cookies from loading until you make a selection.
  2. Your Choices:
  1. Technical Implementation:
  1. Managing Your Preferences:

For Non-EEA Users:

Users outside the EEA may see a simplified cookie notice. While we respect all users' privacy, the consent requirements may differ based on local laws in your jurisdiction.

4.3 Analytics Tools

Microsoft Clarity

We use Microsoft Clarity to understand how users interact with our website through behavioral metrics, heatmaps, and session recordings. This helps us improve our services and user experience.

Hotjar

We use Hotjar to better understand user needs and optimize our service. Hotjar collects data on user behavior to help us improve website usability.

Google Analytics

We use Google Analytics to measure website traffic and usage patterns.

5. How We Share Your Information

We may share your information in the following circumstances:

5.1 Service Providers

We share information with trusted vendors who perform services on our behalf:

Legal Basis: Contract Performance (for essential services), Legitimate Interests, or Consent (for analytics/marketing services)

Data Protection: All service providers are contractually obligated to protect your data and use it only for specified purposes.

5.2 Business Partners

We may share information with:

Legal Basis: Contract Performance or Consent

5.3 Legal Requirements

We may disclose information when required by law:

Legal Basis: Legal Obligations (GDPR Article 6(1)(c)) or Legitimate Interests (GDPR Article 6(1)(f))

5.4 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. You will be notified via email and/or prominent notice on our website of any such change in ownership.

Legal Basis: Legitimate Interests (GDPR Article 6(1)(f))

5.5 With Your Consent

We may share information for other purposes with your explicit consent, such as:

Legal Basis: Consent (GDPR Article 6(1)(a))

6. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your jurisdiction.

6.1 Transfers from the EEA/UK/Switzerland

Azerbaijan does not have an adequacy decision from the European Commission. When we transfer personal data from the EEA, UK, or Switzerland to Azerbaijan or other third countries, we implement appropriate safeguards to protect your information.

Your Rights:

You have the right to request information about the specific safeguards applied to your data transfers and details about the countries where your data is processed.

To request this information, please contact us at info@omex.az with "Data Transfer Information" in the subject line.

6.2 Transfers to Service Providers

Some of our service providers are located in countries with adequate data protection (e.g., EU member states, UK). For providers in other countries (e.g., United States), we implement appropriate technical and organizational safeguards:

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information.

7.1 GDPR Rights (European Economic Area, UK, and Swiss Users)

Right to Access (Article 15)

Right to Rectification (Article 16)

Right to Erasure / "Right to be Forgotten" (Article 17)

Right to Restrict Processing (Article 18)

Right to Data Portability (Article 20)

Right to Object (Article 21)

Right to Withdraw Consent (Article 7(3))

Right to Lodge a Complaint

7.2 CPRA Rights (California Residents)

The California Privacy Rights Act (CPRA), effective January 1, 2023, provides California residents with the following rights:

Right to Know (CPRA §1798.100)

Right to Delete (CPRA §1798.105)

Right to Correct (CPRA §1798.106)

Right to Opt-Out of Sale/Sharing (CPRA §1798.120)

Right to Limit Use of Sensitive Personal Information (CPRA §1798.121)

Under CPRA, the following categories of your data are considered "sensitive personal information":

Your Right to Limit: You have the right to direct us to limit our use of your sensitive personal information to only:

Our Current Use: We use sensitive personal information only for the purposes you would reasonably expect when renting a vehicle:

We do not use sensitive personal information for profiling, advertising, or other secondary purposes.

How to Exercise: If you believe we're using your sensitive information for purposes beyond what's reasonably expected, email info@omex.az with "Limit Sensitive Data" in the subject line.

Response Time: Within 45 days (may be extended to 90 days)

Right to Non-Discrimination (CPRA §1798.125)

Authorized Agents

Verification Process

7.3 Rights for Users in Other Jurisdictions

If you are located in a jurisdiction with data protection laws not specifically mentioned above (e.g., Brazil's LGPD, Canada's PIPEDA), you may have similar rights. Please contact us to learn about your specific rights and how to exercise them.

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

Technical Measures:

Organizational Measures:

Regular Assessments:

Important Notice: However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information using commercially acceptable means, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you and relevant authorities as required by applicable law.

9. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

9.1 Retention Periods

Active Customer Data:

Marketing Data:

Legal and Compliance:

9.2 Deletion Process

When we no longer need your information, we will:

9.3 Your Right to Request Deletion

You may request earlier deletion of your data by exercising your rights under Section 7. However, we may retain certain information where we have a legal obligation or legitimate interest to do so.

10. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

Minimum Age Requirement:

If We Learn of Child Data Collection: If we become aware that we have collected personal information from a child under 18 without verification of parental consent, we will:

  1. Delete that information immediately from our servers
  2. Cease processing the information
  3. Take steps to prevent future collection

Parent/Guardian Notice: If you believe we have collected information from a child under 18, please contact us immediately at info@omex.az with "Child Privacy Concern" in the subject line. We will investigate and take appropriate action.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Notification of Changes:

Version History: We maintain a record of previous versions of this Privacy Policy. To request access to a previous version, please contact us.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Omex Rent A Car

Email: info@omex.az

For Data Protection Inquiries: To exercise your rights or submit data protection requests, please email us with the following in the subject line:

Response Time:

Data Protection Officer: While we are not required to appoint a Data Protection Officer under GDPR (as we are not based in the EU), you may direct privacy concerns to our privacy team at info@omex.az.

Supervisory Authority Complaints: If you are in the EEA/UK and believe we have violated GDPR, you have the right to lodge a complaint with your local supervisory authority. However, we encourage you to contact us first so we can address your concerns directly.

13. Additional Information

13.1 Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to read the privacy policies of any third-party sites you visit.

13.2 Social Media

If you interact with us on social media platforms (Facebook, Instagram, etc.), your interactions are governed by the privacy policies of those platforms in addition to this Privacy Policy.

13.3 Do Not Track Signals

Some browsers have "Do Not Track" features. Our website does not currently respond to Do Not Track signals, but we honor Global Privacy Control (GPC) signals for California users as described in Section 7.2.

13.4 Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you, except for fraud detection purposes which are necessary to protect our business and customers.

Last Updated: February 10, 2026

By using our services, you acknowledge that you have read and understood this Privacy Policy.